experience-ui-bundle-project-generate
Pass
Audited by Gen Agent Trust Hub on Sep 4, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses the Salesforce CLI (
sf template generate project) to scaffold new projects andnpm installto manage dependencies. These are standard operations for Salesforce development workflows. - [INDIRECT_PROMPT_INJECTION]: The skill accepts a user-provided project name (
$NAME) which is used to create directories and name the UI bundle. The instructions specify that the name should be alphanumeric to minimize risks, though the agent must ensure this constraint is respected during execution to prevent potential path issues. - [DYNAMIC_EXECUTION]: The skill includes a local utility script (
scripts/flatten-project.mjs) used to restructure the project files immediately after generation. This script performs file movements (fs.renameSync) and deletions (fs.rmSync) at the target destination to ensure the project root is clean. These actions are standard for project generators and scaffolding tools.
Audit Metadata